drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Mehrere Probleme in Linux
Name: |
Mehrere Probleme in Linux |
|
ID: |
USN-3265-2 |
|
Distribution: |
Ubuntu |
|
Plattformen: |
Ubuntu 14.04 LTS |
|
Datum: |
Di, 25. April 2017, 06:40 |
|
Referenzen: |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6348
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6346
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7374
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5986
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5970
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5897
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6347
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6214
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6345
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5669 |
|
Applikationen: |
Linux |
|
Originalnachricht |
--===============0312618835611241235== Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="8/pVXlBMPtxfSuJG" Content-Disposition: inline
--8/pVXlBMPtxfSuJG Content-Type: text/plain; charset=us-ascii Content-Disposition: inline
========================================================================== Ubuntu Security Notice USN-3265-2 April 25, 2017
linux-lts-xenial vulnerabilities ==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 14.04 LTS
Summary:
Several security issues were fixed in the kernel.
Software Description: - linux-lts-xenial: Linux hardware enablement kernel from Xenial for Trusty
Details:
USN-3265-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 LTS.
It was discovered that a use-after-free flaw existed in the filesystem encryption subsystem in the Linux kernel. A local attacker could use this to cause a denial of service (system crash). (CVE-2017-7374)
Andrey Konovalov discovered an out-of-bounds access in the IPv6 Generic Routing Encapsulation (GRE) tunneling implementation in the Linux kernel. An attacker could use this to possibly expose sensitive information. (CVE-2017-5897)
Andrey Konovalov discovered that the IPv4 implementation in the Linux kernel did not properly handle invalid IP options in some situations. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2017-5970)
Gareth Evans discovered that the shm IPC subsystem in the Linux kernel did not properly restrict mapping page zero. A local privileged attacker could use this to execute arbitrary code. (CVE-2017-5669)
Alexander Popov discovered that a race condition existed in the Stream Control Transmission Protocol (SCTP) implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash). (CVE-2017-5986)
Dmitry Vyukov discovered that the Linux kernel did not properly handle TCP packets with the URG flag. A remote attacker could use this to cause a denial of service. (CVE-2017-6214)
Andrey Konovalov discovered that the LLC subsytem in the Linux kernel did not properly set up a destructor in certain situations. A local attacker could use this to cause a denial of service (system crash). (CVE-2017-6345)
It was discovered that a race condition existed in the AF_PACKET handling code in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-6346)
Andrey Konovalov discovered that the IP layer in the Linux kernel made improper assumptions about internal data layout when performing checksums. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-6347)
Dmitry Vyukov discovered race conditions in the Infrared (IrDA) subsystem in the Linux kernel. A local attacker could use this to cause a denial of service (deadlock). (CVE-2017-6348)
Update instructions:
The problem can be corrected by updating your system to the following package versions:
Ubuntu 14.04 LTS: linux-image-4.4.0-75-generic 4.4.0-75.96~14.04.1 linux-image-4.4.0-75-generic-lpae 4.4.0-75.96~14.04.1 linux-image-4.4.0-75-lowlatency 4.4.0-75.96~14.04.1 linux-image-4.4.0-75-powerpc-e500mc 4.4.0-75.96~14.04.1 linux-image-4.4.0-75-powerpc-smp 4.4.0-75.96~14.04.1 linux-image-4.4.0-75-powerpc64-smp 4.4.0-75.96~14.04.1 linux-image-generic-lpae-lts-xenial 4.4.0.75.62 linux-image-generic-lts-xenial 4.4.0.75.62 linux-image-lowlatency-lts-xenial 4.4.0.75.62 linux-image-powerpc-e500mc-lts-xenial 4.4.0.75.62 linux-image-powerpc-smp-lts-xenial 4.4.0.75.62 linux-image-powerpc64-smp-lts-xenial 4.4.0.75.62
After a standard system update you need to reboot your computer to make all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have been given a new version number, which requires you to recompile and reinstall all third party kernel modules you might have installed. Unless you manually uninstalled the standard kernel metapackages (e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual, linux-powerpc), a standard system upgrade will automatically perform this as well.
References: http://www.ubuntu.com/usn/usn-3265-2 http://www.ubuntu.com/usn/usn-3265-1 CVE-2017-5669, CVE-2017-5897, CVE-2017-5970, CVE-2017-5986, CVE-2017-6214, CVE-2017-6345, CVE-2017-6346, CVE-2017-6347, CVE-2017-6348, CVE-2017-7374
Package Information: https://launchpad.net/ubuntu/+source/linux-lts-xenial/4.4.0-75.96~14.04.1
--8/pVXlBMPtxfSuJG Content-Type: application/pgp-signature; name="signature.asc"
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1
iQIcBAEBCgAGBQJY/rzbAAoJEC8Jno0AXoH0xV4P/0v1hNGhfPP1xyDTeSMpzImr /zS7ezmZ+hit/w27fL6DZRx43E+Y9EkyAbkt2tffsOe77Ddc71b9xNiUgYqq8oLM uUBKhxCnUVucSNE92C3fr8ByJsuXSuvuLdV8rWDIt/S3++4xxDUycvdmDumwriNP +3gaEz2nlF6cag3Uwheb8Bbh4XeTsEdfdUca3NDYhrDUFFuktFzSOPR42He6YKIu 0TewDRYptrh6pm6DHGTiV5GNDg9TW2Q8MGyr/rxoz3cwLHJucFbB/uQea9xrRtdR 9MinWEppAjeo/PTYPp1Y3F6TNLEM4N3TJUZiQL1RN3ids5nFNSJ7NZJIEsVzqyGy rnJos/xfjQqjpqNqbj5HVqwmS0bIxh41QcL6rLq3NNT5UohudR7WOlRyD0qnJbjT x/o78mbhWMWlUACWxyCPdLxjweE5AyAZXNrs5Xzj8PdZcghcZb/dcwgN1U+cuaIc iacww+mky/MD+nHITi8H6xJ2+tQ2ntWIgzSHNEFQ010071pb6ZYThtoyQpbLhU/C UqkjjdLp7gZ0P/SyYOJYpL3fnCRfAryMmtm1+P4IPl+Sf9bgAEEXeCQ73MaySydO LStaHCfGXhdIdVEUcg8ne+3+sHeAVoBfTbDRCmQojs2VZ7THL/UOMCVgxgVM0tjs 4liJpgDKWuyD1O6HM3JM =dCwV -----END PGP SIGNATURE-----
--8/pVXlBMPtxfSuJG--
--===============0312618835611241235== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline
-- ubuntu-security-announce mailing list ubuntu-security-announce@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
--===============0312618835611241235==--
|
|
|
|